Published to npm as @bitkyc08/opencodex@2.7.42 with dist-tag latest.
What's Changed
New Features
- feat(logs): correlate requests by conversation id (#330) by @Wibias in #522
- feat(storage): archived cleanup with quarantine (phase 2 of #42) by @Wibias in #529
Bug Fixes
- fix(codex): make manual account selection immediate by @Ingwannu in #506
- fix(ci): repair invalid LLM JSON escapes in issue translation by @Wibias in #510
- fix(openai-responses): handle image tool conflicts in additional_tools by @RailyW in #492
- fix(release): carry preview changelog into latest notes by @Wibias in #482
- fix(service): retry Windows background install with UAC elevation by @Wibias in #408
- fix(ci): sticky visible issue-translation control comments by @Wibias in #513
- fix(ux): config edit docs, combo effort picker, hide-from-catalog naming by @Wibias in #517
- fix(logs): show effective reasoning effort by @olddonkey in #494
- fix(proxy): attach Retry-After on retryable 429s for Codex by @Wibias in #514
- fix(update): skip redundant GUI restart after npm self-update by @Wibias in #515
- fix(combos): surface catalog omissions in sync and GUI by @Wibias in #516
- fix(kiro): treat pre-output stream socket closes as retryable by @Wibias in #520
- fix(ci): close freeform issue-quality template bypass by @Wibias in #523
- fix(ci): stop PR labeler from reverting human type labels by @Wibias in #525
- Fix Console Go tool schema sanitization by @ShamanicArts in #524
- fix(gui): give every OAuth login surface the same copy affordance by @lidge-jun in #544
- fix(ci): remove broken devlog gitlinks by @lidge-jun in #550
- fix(claude): resolve Desktop 3P paths by target platform by @lidge-jun in #552
- fix(codex): report whether a sync actually wrote the catalog or cache by @lidge-jun in #526
- fix(images): support custom image relay providers by @iF2007 in #551
- fix(bridge): keep wire heartbeats during adapter-only progress (#521) by @Wibias in #555
- fix(bridge): CodeRabbit follow-ups for phase omit and content_filter by @Wibias in #556
- fix(ci): soft-pass detailed issues after maintainer retitle by @Wibias in #564
Chores
- ci: auto-close stale needs-info issues by @Wibias in #530
- ci: close stale needs-info even with roadmap labels by @Wibias in #537
Other Changes
- Fix Windows memory observability for external retention by @lidge-jun in #554
New Contributors
- @RailyW made their first contribution in #492
- @olddonkey made their first contribution in #494
- @ShamanicArts made their first contribution in #524
- @iF2007 made their first contribution in #551
Commits
- release: v2.7.42 (34493b1)
- Merge pull request #564 from Wibias/fix/issue-quality-retitle-softpass (f348166)
- fix(ci): tighten issue-quality soft-pass structure gate (ec59881)
- fix(ci): soft-pass detailed issues after maintainer retitle (8cd659c)
- fix(cli): make star prompt opt-in (0fa45cf)
- fix(bridge): CodeRabbit follow-ups for phase omit and content_filter (#556) (800ebc9)
- fix(bridge): keep wire heartbeats during adapter-only progress (df57bd9)
- fix(images): support custom relay providers (14ae6fe)
- fix(memory): observe external Windows retention (261abb7)
- fix(codex): report catalog and cache write signals (9dd3c42)
- fix(claude): resolve Desktop 3P paths by target platform (7c74e0a)
- fix(ci): remove broken devlog gitlinks (ff83185)
- fix(logs): classify requested output limits correctly (7fcaa91)
- Merge origin/dev: take the landed login-URL parity work (c05e88f)
- Merge origin/dev: keep Desktop's own -3p config-library root (325c8f3)
- fix(gui): give every OAuth login surface the same copy affordance (#544) (0d17425)
- docs(grok): rewrap the fence-clamp comment (35b6bb2)
- docs(devlog): correct the residual-defect classification after the audit (b087705)
- docs(devlog): reproduce and classify the three residual Grok sweep defects (f68b8f9)
- docs(devlog): correct the enforce-target remediation after the audit found it unworkable (0b6c824)
- docs(devlog): diagnose the enforce-target permission defect and its state-corruption edge (1248f36)
- docs(devlog): fold the WP3 audit corrections into the PR disposition (cf5ad9c)
- docs(providers): distinguish the two GLM routes in every locale (7de1a3c)
- test(providers): cover the BigModel contract and the id-collision trap (224db1a)
- feat(providers): add the Zhipu BigModel provider under a non-colliding id (cf0a323)
- docs(devlog): refresh the PR disposition against live state before acting (e0b9598)
- docs(devlog): correct the PR #536 plan after auditing it against the tree (b447d5a)
- docs(devlog): plan the PR #536 Zhipu BigModel provider rework (00c2653)
- fix(grok): stop the orphan sweep from eating the fence it sits next to (8390cdb)
- refactor(gui): move the login-URL block styles out of the workspace stylesheet (928f4b9)
- fix(gui): give every copy affordance one honest protocol (36de83f)
- docs(devlog): fix the clamp plan's child-scan guard before it reintroduces #511 (ae4b0d7)
- docs(devlog): plan the copy-protocol unification and style ownership cleanup (959e892)
- fix(bridge): classify terminal chat answers (d2cc3f6)
- docs(devlog): plan the Grok fence-clamp fix for the #511 follow-up (82bab5f)
- docs(devlog): retract the #511 closure — the sweep destroys an adjacent fence (ead039e)
- fix(ci): preserve nested issue sections (e339155)
- docs(devlog): record the login-URL parity outcome and the two plan deviations (ac6c319)
- fix(gui): restore the non-secure-context clipboard fallback (a19ce5d)
- Merge pull request #529 from Wibias/feat/storage-phase2-cleanup (84f39c4)
- fix(desktop): resolve the Claude Desktop config library the way Desktop does (48b985d)
- fix(adapters): restore desktop config and reasoning summaries (e7d144f)
- docs(devlog): fold the WP1 pre-build audit blockers into the path-fix plan (29f2643)
- refactor(gui): fold the two duplicated login-URL blocks into the shared one (853c408)
- fix(gui): give the Codex account modal the login URL, not just a copy button (3f05fa0)
- fix(gui): derive login-URL copy feedback instead of resetting in an effect (555c3d6)
- feat(gui): add the shared OAuth login-URL block (c136ece)
- docs(devlog): plan login-URL copy parity across all three OAuth surfaces (ef656be)
- docs(devlog): fold the A-phase audit blockers into the triage plan (9d06161)
- docs(devlog): plan the 260727 bug triage loop (issue/PR matrices + #539 RCA) (3613094)
- fix(storage): allowlist cleanup test hooks on management API (3b0c85d)
- fix(storage): address CodeRabbit review on chunking and errors (2caecb9)
- fix(storage): address Codex review on cleanup safety and recovery (8fe960c)
- test(storage): close read-only SQLite handles in busy-satellite regression (df23423)
- Merge pull request #537 from Wibias/ci/stale-needs-info-no-exempt (f327db1)
- ci: close stale needs-info even when roadmap is also set (7a80fe2)
- Merge pull request #530 from Wibias/chore/stale-needs-info (76a8563)
- fix(storage): make satellite lock acquisition and consolidate restore race-safe (9a9653e)
- fix(storage): hold satellite write locks through snapshot and delete (f545c24)
- test(ci): drop redundant stale path allowlist coverage (dfed7ee)
- ci: drop unused contents permission and tighten path assertions (99e9510)
- fix(kiro): harden completion and throttle recovery (e347916)
- test(ci): pin stale-needs-info.yml in Cross-platform CI path allowlist (f06c577)
- ci: ensure stale label exists and disable PR unstaling (8d750f9)
- ci: harden stale needs-info workflow against Codex review (ff5e034)
- ci: auto-close stale needs-info issues after inactivity (71528f3)
- docs(plan): name the external blocker holding wp8 and c5 (f994a35)
- docs(plan): mark the main promotion deferred, not forgotten (a7f58fc)
- fix(gui): restore the copy-login-URL affordance in OAuth login flows (5919779)
- chore(loop): record the wp9 phase transitions (62ff0d7)
- docs(plan): the second review found four more leaks, all reproduced first (bca36a1)
- test(cli): pin the line break to either CR or LF (1de4328)
- fix(cli): close four more ways the authorization code reached stderr (f10c506)
- fix(storage): persist full satellite backup before any delete commit (7209c27)
- fix(cli): stop an unknown flag from being read as the authorization code (d3dc9d7)
- fix(cli): redact the space-separated --code, and refuse a repeated one (e7f5bef)
- test(cli): reach the redaction through a command that does not parse --code (2e72d4c)
- fix(cli): let the OAuth code reach the proxy without passing through argv (d4dfa24)
- fix(storage): make multi-DB cleanup recoverable under state lock (b9af3fd)
- docs(plan): the plan review found two blockers, both reproduced (817494c)
- docs(plan): defer the main promotion, keep the finding it surfaced (5319514)
- docs(plan): wp8 promotes the gate to main, which is where it actually runs (c9b02fd)
- fix(storage): reconcile logs/goals/memories on archived cleanup (8f0ed9a)
- chore(loop): close wp5 on dev; c5 stays open until the gate is promoted to main (b4a9fe5)
- docs(plan): record rounds 15-17 of the PR-target gate coverage review (9967937)
- test(ci): a path filter decides whether the job runs, so pin the list (2b03e90)
- test(ci): the harness answers node24, and a narrowed trigger is a mutation (76c2571)
- fix(gui): reset permanent mode on dismiss and localize presets (da163b1)
- ci: run PR checks on dev2-go, so an accepted PR is also a checked one (5229717)
- fix(storage): address CodeRabbit TOCTOU and recovery messaging (8ec1ca1)
- docs: dev2-go takes pull requests now, in all eight places that said otherwise (10b1d2a)
- ci: let pull requests target dev2-go, not just dev (d761e88)
- fix(gui): sync cleanup busyRef in an effect (87ffd78)
- chore(loop): close wp7 with rounds 11-14 evidence, leave wp5 pending approval (de6a39f)
- fix(storage): write cleanup manifest before DB commit (6ae3bd5)
- fix(storage): resolve remaining CodeRabbit cleanup review notes (1f794c6)
- test(ci): state fields are read for truthiness, not for their type (dbd558e)
- test(ci): trust state written by a version the reader does not know (5f7afc2)
- fix(storage): bind cleanup to preview digest and make it atomic (1f634e7)
- test(ci): cover reachable states, and reject the way Octokit rejects (6d08cb9)
- test(ci): pin the trigger's shape, not just its name and event list (e6aadac)
- test(ci): model the webhook payload, and assert what the comment says (1aab8a9)
- test(ci): match the shape of each injected binding, not just its name (a78fe94)
- test(ci): build the harness scope from the pinned action, not by hand (535ac31)
- test(ci): drain deferred work and cover PRs the author already touched (afcfddd)
- fix(storage): address CodeRabbit review on cleanup APIs and i18n (888e434)
- feat(cli): add headless dashboard parity (918a0c8)
- chore(loop): record wp7 hardening rounds in the goalplan ledger (849515f)
- test(ci): close the harness's global escapes and error-shape gap (1696d2b)
- test(ci): make the PR-target harness behave like the real runner (c6b00e9)
- feat(storage): archived cleanup with quarantine default (phase 2) (e2a0eda)
- Merge pull request #524 from ShamanicArts/codex/fix-zen-go-tool-schemas (cd1e13c)
- test(ci): run the PR-target script instead of reading it (c21f16b)
- test(ci): pin the PR-target workflow by allowlist instead of deny-list (4b76c78)
- test(ci): close six more PR-target bypasses an audit round found (078eaf0)
- test(ci): tie each draft helper to its GraphQL mutation (8bfdf8e)
- test(ci): stop the comment stripper from truncating string literals (b0ef4e2)
- test(ci): parse the PR-target workflow instead of grepping it (7038a46)
- test(ci): close three holes in the PR-target characterisation tests (4b8b888)
- test(ci): pin the current behaviour of the PR target check (7c8f2e3)
- docs(devlog): reconcile the plan with what the check actually did (800f7ea)
- docs(devlog): record what the target-branch check actually did to a stacked PR (248da1a)
- docs: mark the maintainer-change procedure as in progress, not complete (02bbd47)
- docs: state what the maintainer addition does and does not enforce (dc3a4ad)
- docs: add @Wibias as a maintainer (a2693c0)
- docs: carry the branch policy to the public guide and resolve a reviewer conflict (93f60e3)
- docs: document dev2-go as an integration line and welcome porting/rebase PRs (79b4b01)
- docs(devlog): close the docs-only roadmap cycle for the governance intake (43fd06b)
- docs(devlog): record the recommended gate option and its test conditions (ead5d1b)
- docs(devlog): fix two plan commands that do not actually run (f9387b6)
- docs(devlog): bind the split to a frozen SHA and check approvals against the current head (f8e52df)
- docs(devlog): correct the plan — a dev2-go PR cannot merge while the check forces draft (40913b8)
- docs(devlog): correct the plan after the fourth audit — sticky automation, live PR state, real approval (172c604)
- docs(devlog): split the PR-target gate out after three audits broke three designs (ac48d38)
- docs(devlog): replace path inference with maintainer labels after the second audit (786e203)
- docs(devlog): rewrite the governance plan after the audit found it would not take effect (156b10e)
- docs(devlog): plan the governance intake — dev2-go PRs, PR split, maintainer addition (0c69c6b)
- Merge pull request #525 from Wibias/fix/pr-labeler-respect-manual (ce4d03e)
- fix(ci): cancel stale labeler runs on human label changes (c8fcc2b)
- feat(ci): label sentence-case PR titles without conventional colon (34c6a66)
- fix(ci): address PR labeler review feedback (59d4ec4)
- fix(ci): stop PR labeler from reverting human type labels (9a43d78)
- Merge pull request #522 from Wibias/fix/330-session-log-correlation (4618c93)
- docs(devlog): triage the overnight merges, open PRs, and issue backlog (edf3b2c)
- docs(devlog): close out the Grok dead-port cycle with audit rebuttals and live evidence (0cc14c4)
- fix(grok): surface a fence that points at a port we are not listening on (5451cd1)
- docs(devlog): root-cause the Grok retry loop as opencodex entries pinned to a dead port (3286c4a)
- fix Console Go tool schema sanitization (f257665)
- Merge pull request #523 from Wibias/fix/issue-quality-freeform-bypass (703c619)
- fix(ci): close freeform issue-quality template bypass (30bd705)
- fix(gui): avoid control-char regex in conversation filter (dab58b4)
- Merge pull request #520 from Wibias/fix/519-kiro-heartbeat-retryable (49c63e1)
- fix(logs): address Codex review on conversation correlation (#522) (a239460)
- fix(kiro): force non-retryable fallback incompletes after prior output (8ea2c52)
- fix(kiro): force non-retryable classified errors after flushed output (5f22d28)
- feat(logs): correlate requests by conversation id (#330) (e7b103d)
- fix(kiro): gate fallback setup retryability on prior output (58c3dc2)
- fix(kiro): address Codex review on stream catch retryability (34c38e8)
- Merge pull request #516 from Wibias/fix/combo-catalog-omission-warnings (75f9fe5)
- fix(kiro): treat pre-output stream socket closes as retryable (a892983)
- test(combos): cover incompatible omission reason in sync CLI summary (7281fb8)
- fix(combos): distinguish incomplete vs incompatible omission reasons (4d2fb61)
- Merge pull request #515 from Wibias/fix/gui-update-redundant-restart (0aa0c62)
- Merge pull request #514 from Wibias/fix/kiro-429-retry-after (1803480)
- fix(logs): show effective reasoning effort (#494) (85aa075)
- Merge pull request #517 from Wibias/fix/ux-paper-cuts-488 (3eff0cf)
- test(proxy): raise Windows CI budgets for OpenAI auth matrix (45bf88c)
- fix(update): require correlated identity after npm GUI restart (7fb8e2f)
- test(gui): expect Models visibility counts as visible (3c452a7)
- fix(proxy): sanitize passthrough Retry-After on non-empty errors (51c50be)
- fix(gui): treat unknown combo effort ladders as empty (b79f9b7)
- fix(combos): address Codex review on catalog omission surfacing (076f588)
- fix(gui): avoid Set inference error in combo effort intersection (c4d259b)
- fix(gui): type attentionCopy with TFn for combo catalog warnings (a030938)
- fix(gui): isolate debug PUT-order test from client-resource cache (5a29b47)
- docs(i18n): align zh/ja config concurrent-edit warnings with #488 (0e26bb6)
- fix(ux): clarify config edits, combo effort picker, model hide naming (#488) (69ac0dc)
- test(proxy): align #452 Retry-After: 0 expectation with client preserve (ec3b4a1)
- fix(update): require evidence before skipping npm GUI restart (5dbeef5)
- fix(combos): surface catalog omissions in sync and GUI (#484) (525fc58)
- fix(proxy): harden Retry-After client vs cooldown split (7f34fc0)
- fix(update): skip redundant GUI restart after npm self-update (0be28c4)
- fix(proxy): attach Retry-After on retryable 429s for Codex (#507) (6b772ca)
- Merge pull request #513 from Wibias/fix/translation-control-sticky-visible (58f0fab)
- fix(gui): keep a window.event stub across rail-hover teardown (f940cd6)
- fix(ci): force unknown language on incomplete translation attempts (a19b240)
- fix(ci): stop false-English bookkeeping on incomplete translation parses (3c5b0d1)
- fix(gui): flush React teardown before happy-dom window restore (7de8a17)
- fix(ci): keep sticky visible translation control comments (1c92652)
- fix(grok): sweep an orphan's sub-tables too, not just its parent (7ba0fec)
- docs(devlog): record the orphan sweep against the real Grok config (b109fcf)
- fix(grok): adopt our own pre-fence model entries so context windows are honoured (5ff20dc)
- docs(devlog): plan Grok orphan adoption and triage the open PRs (7839be0)
- Merge pull request #408 from Wibias/codex/fix-windows-service-install-elevation (ebf947e)
- Merge pull request #482 from Wibias/fix/stable-release-notes-carry-preview (a7f45f3)
- Merge pull request #492 from lidge-jun/fix/openai-responses-image-tool-conflicts (7d8c359)
- Merge remote-tracking branch 'origin/dev' into dev (6062b20)
- Merge pull request #510 from Wibias/fix/issue-translation-invalid-json-escapes (fbc24c9)
- fix(ci): tighten translation completion contract for parse and apply (aae08f7)
- Merge remote-tracking branch 'origin/dev' (77711f8)
- fix(ci): address CodeRabbit translation-state follow-ups (0a1a28a)
- fix(ci): separate translation rate-limit attempts from completed sources (d8d1542)
- fix(ci): preserve literal backslashes when repairing translation JSON (262a900)
- feat(ci): inline-translate non-English issue comments (758c173)
- fix(ci): repair invalid LLM JSON escapes in issue translation (21a2f20)
- test(claude): prove the settings.json hijack defence per auth resolution (1eb7269)
- Merge pull request #506 from lidge-jun/agent/fix-issue-504-immediate-account (2d5d491)
- fix(codex): make manual account selection immediate (ea2766a)
- fix(openai-responses): handle image tool conflicts in additional_tools (04fefb0)
- fix(release): classify preview lookup by HTTP status, not stderr (11b2933)
- fix(release): baseline only on newest meaningfully carried preview (fd83ecd)
- fix(release): harden preview note carry for Codex review (40ced9b)
- fix(release): carry preview changelog into latest notes (ecdb943)
- fix(service): use path-aware trusted executable containment (b711ddf)
- fix(service): address CodeRabbit Windows elevation review follow-ups (13a870a)
- fix(service): fail closed on unverifiable Task Scheduler probes (4640bbb)
- fix(service): keep elevation spawn tests working without System32 (733c6f2)
- fix(service): resolve elevated Windows binaries via GetSystemDirectoryW (c55db9d)
- fix(service): harden elevation scripts and timeout reconciliation (d435ce3)
- fix(service): keep install lock across elevation request timeouts (62c4017)
- fix(service): replace elevated temp-file IPC with protocol exit codes (b2005b4)
- fix(service): use one UAC for create+run and fail closed on /run (0deda7c)
- fix(service): address CodeRabbit elevation review comments (d1ccd9f)
- fix(service): elevate only structured schtasks create denials (45f66d8)
- fix(service): address Windows elevation review feedback (cacd6c3)
- fix(service): retry Windows background install with UAC elevation (59bc0b7)
Full Changelog: v2.7.41...v2.7.42